CVE-2026-93042

CVE-2026-93042 affects the Linux kernel dw-edma DMA engine driver. When a deferred STOP reaches the interrupt handler, the driver calls vchan_cookie_complete(), which schedules a callback for the active descriptor and leaves other issued or submitted descriptors queued—contrary to the DMA Engine ...

CVE-2026-93040

CVE-2026-93040 is a race condition in the Linux kernel's dw-edma DMA engine driver. The pause() and resume() functions read and update channel state without holding vc.lock , while interrupt handlers update the same state under that lock. This allows a scenario where pause() observes the channel ...

CVE-2026-93038

This Linux kernel vulnerability affects the iio: dac: ad5686 driver. The root cause is a missing NULL check on the chip_info pointer (match data). When a user binds the driver using driver_override via sysfs with a device name not present in the id_table or of_match_table, the match data resolves...

CVE-2026-93039

CVE-2026-93039 affects the Linux kernel 's ASoC meson audio driver. In meson_card_reallocate_links(), two consecutive krealloc() calls grow the DAI link and private data arrays, but owner pointers are only updated after both succeed. If the first krealloc() moves the block and the second fails, c...

CVE-2026-93037

CVE-2026-93037 affects the Linux kernel in the RDMA/hfi1 driver. The function set_txreq_header_ahg() ignores the return value of sdma_txinit_ahg(). When that call fails, it returns before initializing tx->txreq, yet the error is discarded and the caller continues processing the request as thou...

CVE-2026-92524

CVE-2026-92524 affects the Linux kernel GIC-v3-ITS irqchip driver. The root cause is a resource leak in its_vpe_irq_domain_alloc(): when its_irq_gic_domain_alloc() fails, the subsequent its_vpe_irq_domain_free() does not invoke its_vep_teardown() for the corresponding interrupt, leaving the resou...

CVE-2026-92525

CVE-2026-92525 is a vulnerability in the Linux kernel RDMA/rxe subsystem. For user-space queue pairs, rxe_post_send() takes the is_user branch and schedules send_task without validating the WQE . When rxe_requester() later calls copy_data(), it indexes wqe->dma.sge[cur_sge] using attacker-cont...

CVE-2026-92523

CVE-2026-92523 affects the Linux kernel in the RDMA/nldev subsystem. The vulnerability is an input validation flaw: RDMA_NLDEV_ATTR_STAT_HWCOUNTERS is a nested Netlink attribute whose children are read directly via nla_get_u32() . The top-level policy validates only the container, not the fixed s...

CVE-2026-92521

CVE-2026-92521 affects the Linux kernel ACPI PCI subsystem. In acpi_pci_root_add(), the freshly allocated root is assigned to device->driver_data before dmar_device_add() and pci_acpi_scan_root(). When dmar_device_add() fails during a hot-add, the root is freed via kfree() but driver_data is l...

CVE-2026-92522

CVE-2026-92522 is a Linux kernel vulnerability in the ACPI processor module's IOAPIC hotplug lookup. The root cause is insufficient bounds validation when parsing MADT and _MAT records: the MADT walk advanced the cursor using a subtable's declared length after only locating a generic header, and ...

CVE-2026-92520

CVE-2026-92520 affects the Linux kernel 's BPF subsystem, specifically the queue and stack pop/peek helpers . The verifier expects these helpers to initialize their output buffer, and the empty-map error path does clear it. However, a failed lock acquisition returns -EBUSY without writing the buf...

CVE-2026-92518

CVE-2026-92518 affects the Linux kernel on RISC-V when CONFIG_CFI_CLANG is enabled. The root cause is in the BPF tailcall implementation: prog->bpf_func already skips the kcfi instruction during setup, but including it again in the tailcall jump offset causes the jump to skip an extra 4 bytes,...

CVE-2026-92519

CVE-2026-92519 is a memory leak in the Linux kernel affecting the RISC-V BPF JIT subsystem. When BPF JIT compilation fails for a later subprogram, the kernel calls bpf_jit_free() to clean up an earlier subprogram, but the function fails to free jit_data->ctx.offset , leaking the JIT context of...

CVE-2026-92517

CVE-2026-92517 affects the Linux kernel on RISC-V , specifically in the BPF arena load_acquire path. The root cause is in emit_atomic_ld_st(), which returns a non-zero value (1) to signal that build_body() should skip a zero-extension step. Because the caller uses ret = ret ?: add_exception_handl...

CVE-2026-92516

CVE-2026-92516 affects the Linux kernel's BPF subsystem . The bug is in the verifier's offset warning check: the case statement for BPF_RES_SPIN_LOCK incorrectly referenced the offset for BPF_SPIN_LOCK instead of res_spin_lock_off . The fix corrects this by checking the proper offset variable. Th...

CVE-2026-92515

CVE-2026-92515 affects the Linux kernel BPF subsystem, specifically the BTF (BPF Type Format) field-traversal logic. The root cause is that btf_find_struct_field() re-initializes its seen mask on every recursive descent, so unique special fields at different nesting levels of the same aggregate a...

CVE-2026-92514

CVE-2026-92514 is a use-after-free vulnerability in the Linux kernel's RDMA/erdma driver. During CEQ (Completion Event Queue) teardown, erdma_ceqs_uninit() calls free_irq(), which waits for an in-flight hard-IRQ handler but does not drain a tasklet that the handler already scheduled. That tasklet...

CVE-2026-92512

A use-after-free vulnerability in the Linux kernel RDMA/core subsystem affects the ib_query_qp() function. When a QP is queried via the netlink resource tracking flow, the only synchronization is rdma_restrack_get() , but on the destroy path, rdma_restrack_del() is called too late—after vendor-sp...

CVE-2026-92513

CVE-2026-92513 is a use-after-free vulnerability in the Linux kernel's mana_ib RDMA driver (Microsoft Azure MANA InfiniBand). The root cause lies in mana_table_store_ud_qp(), which publishes a QP at its send-queue ID before inserting the receive-queue ID, dropping the XArray lock between the two ...

CVE-2026-92511

CVE-2026-92511 is a use-after-free vulnerability in the Linux kernel's RDMA/core subsystem, specifically in ib_destroy_cq_user(). When a Completion Queue (CQ) is accessed via the netlink path, the only synchronization mechanism is rdma_restrack_get(). The flaw arises because rdma_restrack_del() w...